1 / 26

Lecture 6 User Authentication ( cont )

Lecture 6 User Authentication ( cont ). modified from slides of Lawrie Brown. Password File Access Control. can block offline guessing attacks by denying access to encrypted passwords. make available only to privileged users. vulnerabilities.

gunda
Download Presentation

Lecture 6 User Authentication ( cont )

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Lecture 6User Authentication (cont) modified from slides of Lawrie Brown

  2. Password File Access Control • can block offline guessing attacks by denying access to encrypted passwords • make available only to privileged users • vulnerabilities • weakness in the OS that allows access to the file • accident with permissions making it readable • users with same password on other systems • access from backup media • sniff passwords in network traffic • shadow password file • a separate file from the user IDs where the hashed passwords are kept

  3. Password Selection Techniques • user education • users can be told the importance of using hard to guess passwords and can be provided with guidelines for selecting strong passwords • computer generated passwords • users have trouble remembering them • reactive password checking • system periodically runs its own password cracker to find guessable passwords • proactive password checking • user is allowed to select their own password, however the system checks to see if the password is allowable, and if not, rejects it • goal is to eliminate guessable passwords while allowing the user to select a password that is memorable

  4. Proactive Password Checking • rule enforcement • specific rules that passwords must adhere to • password cracker • compile a large dictionary of passwords not to use • Bloom filter • used to build a table based on dictionary using hashes • check desired password against this table

  5. Types of Cards Used as Tokens

  6. Memory Cards • can store but do not process data • the most common is the magnetic stripe card • can include an internal electronic memory • can be used alone for physical access • hotel room, ATM • provides significantly greater security when combined with a password or PIN • drawbacks of memory cards include: • requires a special reader • loss of token • user dissatisfaction

  7. Smartcard • physical characteristics: • include an embedded microprocessor • a smart token that looks like a bank card • can look like calculators, keys, small portable objects • interface: • manual interfaces include a keypad and display for interaction • electronic interfaces communicate with a compatible reader/writer • authentication protocol: • static, dynamic password generator and challenge-response

  8. Smart Card Dimensions The smart card chip is embedded into the plastic card and is not visible. The dimensions conform to ISO standard 7816-2.

  9. Communication Initialization between a Smart Card and a Reader Communication Initialization between a Smart Card and a Reader

  10. Biometric Authentication • attempts to authenticate an individual based on • unique physical characteristics • pattern recognition • technically complex and expensive • compared to passwords and tokens • physical characteristics used include: • facial characteristics • fingerprints • hand geometry • retinal pattern • iris • signature • voice

  11. Cost Versus Accuracy

  12. Operation of a Biometric System A Generic Biometric System Enrollment creates an association between a user and the user’s biometric characteristics. Depending on the application, user authentication either involves verifying that a claimed user is the actual user or identifying an unknown user.

  13. Biometric Accuracy

  14. Biometric Measurement Operating

  15. Actual Biometric Measurement Operating Characteristic Curves

  16. Remote User Authentication • authentication over a network, the Internet, or a communications link is more complex • additional security threats such as: • eavesdropping, capturing a password, replaying an authentication sequence that has been observed • generally rely on some form of a challenge-response protocol to counter threats

  17. Password Protocol • user transmits identity to remote host • host generates a random number (nonce) • nonce is returned to the user • host stores a hash code of the password • function in which the password hash is one of the arguments • use of a random number helps defend against an adversary capturing the user’s transmission Example of a challenge-response protocol

  18. Token Protocol • user transmits identity to the remote host • host returns a random number and identifiers • token either stores a static passcode or generates a one-time random passcode • user activates passcode by entering a password • password is shared between the user and token and does not involve the remote host Example of a token protocol

  19. Static Biometric Protocol • user transmits an ID to the host • host responds with a random number and the identifier for an encryption • client system controls biometric device on user side • host decrypts incoming message and compares these to locally stored values • host provides authentication by comparing the incoming device ID to a list of registered devices at the host database Example of a static biometric protocol

  20. Dynamic Biometric Protocol • host provides a random sequence and a random number as a challenge • sequence challenge is a sequence of numbers, characters, or words • user at client end must then vocalize, type, or write the sequence to generate a biometric signal • the client side encrypts the biometric signal and the random number • host decrypts message and generates a comparison Example of a dynamic biometric protocol

  21. denial-of-service • attempts to disable a user authentication service by flooding the service with numerous authentication attempts • host attacks • directed at the user file at the host where passwords, token passcodes, or biometric templates are stored • eavesdropping • adversary attempts to learn the password by some sort of attack that involves the physical proximity of user and adversary • Authentication Security Issues • replay • adversary repeats a previously captured user response • Trojan horse an application or physical device masquerades as an authentic application or device for the purpose of capturing a user password, passcode, or biometric • client attacks • adversary attempts to achieve user authentication without access to the remote host or the intervening communications path

  22. Potential Attacks, Susceptible Authenticators, and Typical Defenses

  23. Practical Application:Iris Biometric System

  24. Case Study: ATM Security Problems

  25. Summary • means of authenticating a user’s identity • something the individual knows, possesses, is, does • vulnerability of passwords • offline dictionary attack • specific account attack • popular password attack • password guessing against single user • workstation hijacking • exploiting user mistakes • exploiting multiple password use • electronic monitoring • hashed password and salt value • password file access control • password selection strategies • user education • computer generated passwords • reactive password checking • proactive password checking • Bloom filter • token based authentication • memory cards • smart cards • biometric authentication • remote user authentication • password protocol • token protocol • static biometric protocol • dynamic biometric protocol

More Related